"ESXi Host Certificate Status" alert for any host in vCenter Server

Products

• VMware vSphere ESX 7.x
• VMware vSphere ESX 8.x

Issue/Introduction

An ESXi host is marked with an alarm stating "ESXi Host Certificate Status" when the host certificate is nearing or past its expiration date.

 

Cause

vCenter Server monitors all the certificates within the VMware Endpoint Certificate Store. It triggers a Certificate Status alarm within the vCenter Server if any certificate is close to its expiration date.

Resolution

Renew the affected ESXi Host's SSL certificate

For self-signed certificates

Renew an ESXi host certificate using the vSphere UI directly to a host or on the vCenter Server:

1. Browse to the host in the vSphere Client inventory.
2. Click Configure.
3. Under System, click Certificate. You can view detailed information about the selected host's certificate.
4. Click Renew or Refresh CA Certificates
   Renew: Retrieves a fresh signed certificate for the host from VMCA.
   Refresh CA Certificates : Pushes all certificates in the TRUSTED_ROOTS store in the vCenter Server VECS store to the host.
   
5. Click Yes to confirm.

If you are unable to manage affected ESXi host from vCenter Server vSphere UI, renew ESXi host certificate using SSH session:

1. In a web browser, log in to the ESXi host using the VMware Host Client.
2. In the Actions menu, click Services > Enable Secure Shell (SSH).
3. Log in to the ESXi host using an SSH client such as Putty.
4. Regenerate the self-signed certificate by executing the following command:
   

   $ /sbin/generate-certificates

5. Restart the hostd and vpxa services by executing the following command:
   

   $ /etc/init.d/hostd restart && /etc/init.d/vpxa restart

6. Log back into the VMware Host Client and click Services > Disable Secure Shell (SSH) from the Actions menu.
7. Repeat the above steps for all remaining hosts.

For custom CA certificates see the knowledge base article at Configuring CA signed certificates for ESXi hosts

Additional Information

Prerequisites before refreshing/renewing the ESXi SSL certificates from vCenter server vSphere UI:

• The ESXi hosts are connected to the vCenter Server.
• Ensure time synchronization between the vCenter Server system and the ESXi hosts.
• DNS resolution works between the vCenter Server system and the ESXi hosts.
  • The vCenter Server system's MACHINE_SSL_CERT and TRUSTED_ROOT certificates are valid and have not expired. See the knowledge base article at Manually reviewing certificates in VMware Endpoint Certificate Store for vSphere 6.x and 7.x.
• The ESXi hosts are NOT in maintenance mode.

 

For more information, see Certificate Management for ESXi Hosts.